CVE-2020-5247
Summary
| CVE | CVE-2020-5247 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-02-28 17:15:00 UTC |
|---|
| Updated | 2023-11-07 03:23:00 UTC |
|---|
| Description | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server. This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 31 Update: rubygem-puma-3.12.4-1.fc31 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 30 Update: rubygem-puma-3.12.4-1.fc30 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] [DLA 3023-1] puma security update |
MLIST |
lists.debian.org |
|
| [SECURITY] Fedora 32 Update: rubygem-puma-4.3.3-1.fc32 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 30 Update: rubygem-puma-3.12.4-1.fc30 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix) |
MISC |
www.ruby-lang.org |
Vendor Advisory |
| HTTP Response Splitting · Advisory · puma/puma · GitHub |
CONFIRM |
github.com |
Mitigation, Third Party Advisory |
| HTTP Response Splitting Software Attack | OWASP Foundation |
MISC |
owasp.org |
Third Party Advisory |
| [SECURITY] Fedora 32 Update: rubygem-puma-4.3.3-1.fc32 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 31 Update: rubygem-puma-3.12.4-1.fc31 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 179346 Debian Security Update for puma (DLA 3023-1)
- 750577 OpenSUSE Security Update for rmt-server (openSUSE-SU-2020:2000-1)
- 750580 OpenSUSE Security Update for rmt-server (openSUSE-SU-2020:1993-1)
- 900069 CBL-Mariner Linux Security Update for ruby 2.6.3
- 902975 Common Base Linux Mariner (CBL-Mariner) Security Update for ruby (2672)
